Security & data handling
Your pipeline is your business. This page describes what Listlio actually does to protect it — and, at the bottom, what we do not yet have. Everything listed here is implemented today; we do not list roadmap items as if they were shipped.
Workspace isolation at the database
Every table carrying customer data is protected by row-level security policies enforced by Postgres itself, not by application-layer filtering. A query that escapes the app's own checks still returns nothing for another workspace's rows, because the isolation lives below the application.
Secrets encrypted server-side
API keys, integration tokens and webhook secrets are held encrypted in Supabase Vault and only decrypted inside server-side functions. They are never sent to the browser and never present in the client bundle.
Private file storage
Lead attachments and uploaded property media live in private storage buckets with per-user access policies. Files are not served from public URLs — access is checked against the requesting user on every read.
Hardened transport and headers
HTTPS is enforced with HSTS including subdomains. Responses carry a Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and frame-ancestors restrictions, so the app cannot be framed or have third-party scripts injected into it.
Verified, idempotent billing events
Payment webhooks are signature-verified before they are trusted, and processed through an idempotency table so a replayed or duplicated event cannot change a subscription twice.
AI processing boundaries
Content you generate is produced from your workspace's own data. We do not use customer data to train shared models, and we do not sell it. Generated output is always a draft for you to review — nothing is published to a channel without your approval.
Reporting a vulnerability
Email security@listlio.com with steps to reproduce. We aim to acknowledge within three business days. Please do not access, modify or exfiltrate other users’ data while testing, and give us a reasonable window to ship a fix before publishing details.
Common questions
Who can see my leads and listings?
Only members of your own workspace. Data access is enforced by row-level security policies in Postgres, which apply to every query regardless of how it reaches the database. Within an agency workspace, role-based permissions control which agents can see which records.
Do you use my data to train AI models?
No. Your leads, listings, client conversations and generated content are used to serve your workspace only. We do not use customer data to train shared or third-party models, and we do not sell it.
What happens to my data if I cancel?
You can export your leads, listings and generated content at any time, including after cancelling. Deletion requests are handled through support — contact security@listlio.com or support@listlio.com and we will confirm what has been removed.
How do I report a security vulnerability?
Email security@listlio.com with enough detail to reproduce the issue. We aim to acknowledge within three business days. Please give us a reasonable window to fix the issue before disclosing it publicly, and do not access, modify or exfiltrate other users' data while testing.
Do you have SOC 2 or ISO 27001 certification?
Not currently. We would rather say so than imply otherwise — if a formal certification is a procurement requirement for your brokerage, contact us and we will tell you honestly where we are and what we can provide in the meantime, such as details of our infrastructure providers and their certifications.
See also our privacy policy, terms of service and system status.